Overview & Concepts
What is Visitor Mode?
Visitor mode enables anonymous public access to your community, allowing users to browse and discover content without requiring authentication. This feature is ideal for growth funnels, SEO optimization, and public content discovery while maintaining platform security and stability.Visitor Users
Access: Read-only permissions enforced server-side
Tracking: Identified by device fingerprinting
Use Case: Public content discovery, growth funnel
Bot Users
Access: Read-only permissions for content indexing
Tracking: Identified by User-Agent analysis
Use Case: SEO optimization, content discoverability
How Visitor Mode Works
Visitor mode uses device fingerprinting to identify anonymous users while maintaining privacy:Device Identification
Visitor Login
Server-Side Role Assignment
Read-Only Access
User Type Comparison
Understanding the different user types helps you design the right access patterns:- Signed-In Users
- Visitor Users
- Bot Users
- ✅ Full read/write access to all features
- ✅ Real-time event connections (MQTT)
- ✅ Push notifications
- ✅ Create posts, comments, reactions
- ✅ Join communities and follow users
Quick Start (Visitor Mode)
Step 1: Initialize the SDK
Start by setting up the social.plus client with your API key:Step 2: Get Visitor Device ID
Generate or retrieve a unique device identifier for the visitor:Step 3: Login as Visitor
Authenticate as an anonymous visitor to access public content:Step 4: Login as Bot (TypeScript Only)
For search engine crawlers and automated indexers:Step 5: Check User Type
Verify the current user type to adapt your UI accordingly:Step 6: Logout
End the visitor session:Secure Visitor Mode (Production)
For production environments, secure visitor mode adds an extra layer of authentication by requiring cryptographic signatures for visitor sessions. Once secure mode is enabled, all visitor login requests must include a valid auth signature generated by your backend server.Getting Your Visitor Secret
After visitor secure mode is enabled for your network, retrieve your visitor application secret from the Console:Navigate to Settings
Locate Visitor Secret
Copy Secret
Backend Auth Signature Generation
Your backend server must generate time-limited auth signatures using HMAC-SHA256 encryption:- Install dependencies:
- Create a
.envfile in your project root:
- Run the server:
Secure Visitor Login
Use auth signatures for production visitor sessions: Obtain authSignature via the API implemented in the previous step, and provide the corresponding values to loginAsVisitory() function.Session Handler for Token Renewal
Implement session handlers to automatically refresh auth signatures:- iOS
- Android
- TypeScript
Understanding Visitor Permissions
Visitor and bot users have server-side enforced read-only permissions to protect community integrity:Allowed Actions ✅
- View public posts and content
- Browse public communities
- View user profiles
- View comments and replies
- View post reactions
- Access public media (images, videos)
Restricted Actions ❌
- Create posts or stories
- Comment or reply
- React to posts/comments
- Join communities
- Follow/unfollow users
- Report content or users
- Send messages
- Receive push notifications
- Real-time event connections (MQTT)
Permission Enforcement
All visitor restrictions are enforced server-side - attempting restricted actions will result in permission errors:Resource Conservation
Visitors and bots are excluded from resource-intensive features:- Real-Time Events
- Push Notifications
- User Discovery
- No real-time event subscriptions
- No live updates or notifications
- Reduces server load and connection costs
- Does not count towards CCU (Concurrent Connection Users) limits
UIKit Visitor Experience
UIKit automatically adapts to visitor mode with optimized navigation and content discovery:Page Visibility
UIKit shows/hides pages based on user type:- Visitor Mode
- Signed-In User
- ✅ Explore (default homepage)
- ✅ Clips Feed (configurable, hidden by default)
- ❌ Newsfeed
- ❌ Notifications
- ❌ My Communities
Adaptive Navigation
UIKit navigation automatically adjusts based on available pages:Mobile Navigation
- Top tab navigation bar is hidden
- Cleaner, focused single-page experience
- Top tab navigation bar remains visible
- Users can switch between available pages
Desktop Navigation
- Main sidebar navigation always shown
- Ensures persistent access to global elements
- Includes search bar and other navigation tools
- Maintains consistent desktop experience
Visitor Interaction Handling
UIKit provides default behaviors for visitor interaction attempts:Action Button States
UIKit manages action button visibility based on user type and permissions:Public Community Actions
Public Community Actions
| Action | Visitor | Non-Member | Member |
|---|---|---|---|
| React to Post | Button visible, action blocked | Button visible, action allowed | Button visible, action allowed |
| Comment on Post | Button visible, action blocked | Button visible, action allowed | Button visible, action allowed |
| Reply to Comment | Button visible, action blocked | Button visible, action allowed | Button visible, action allowed |
| Report Content | Button visible, action blocked | Button visible, action blocked | Button visible, action allowed |
| Vote in Poll | Button visible, action blocked | Button hidden, join required | Button visible, action allowed |
User Profile Actions
User Profile Actions
| Action | Visitor | Signed-In User |
|---|---|---|
| React to Post | Button hidden | Button visible, action allowed |
| Comment on Post | Button visible, action blocked | Button visible, action allowed |
| Reply to Comment | Button visible, action blocked | Button visible, action allowed |
| Report Post | Button visible, action blocked | Button visible, action allowed |
| Follow User | Button visible, action blocked | Button visible, action allowed |
| Block User | Button visible, action blocked | Button visible, action allowed |
Story & Clip Actions
Story & Clip Actions
| Action | Visitor | Signed-In User |
|---|---|---|
| React to Story | Button visible, action blocked | Button visible, action allowed |
| React to Clip | Button visible, action blocked | Button visible, action allowed |
| Comment on Clip | Button visible, action blocked | Button visible, action allowed |
Livestream Actions
Livestream Actions
| Action | Visitor | Signed-In User |
|---|---|---|
| Send Message | Input visible, action blocked | Input visible, action allowed |
| React to Message | Button visible, action blocked | Button visible, action allowed |
| Report Message | Button visible, action blocked | Button visible, action allowed |
Customizing Visitor Behavior
Override default behaviors to match your app’s UX:Data Management & Lifecycle
Guest User Data Cleanup
To prevent accumulation of transient visitor data, social.plus automatically cleans up inactive guest users:Automatic Cleanup Policy
Automatic Cleanup Policy
- Scheduled job runs automatically
- Identifies inactive guest user records
- Permanently deletes inactive guest data
- No manual intervention required
- Guest user profile records
- Device fingerprint associations
- Session history
- Any cached visitor data
Data Retention Considerations
Data Retention Considerations
Implementation Best Practices
Visitor Mode Strategy
When to Use Visitor Mode ✅
When to Use Visitor Mode ✅
-
Public Content Discovery
- Community showcases and landing pages
- SEO-optimized public content
- Growth funnel entry points
- Social media linked content
-
Conversion Optimization
- Allow browsing before signup
- Demonstrate community value
- Reduce friction in user journey
- Track engagement before conversion
-
SEO & Indexing
- Enable search engine crawling
- Improve content discoverability
- Separate bot traffic from analytics
- Optimize for organic search
- Set clear upgrade prompts for interactive features
- Track visitor-to-member conversion rates
- Monitor guest traffic patterns
- Use analytics to optimize conversion flow
When to Require Authentication ❌
When to Require Authentication ❌
-
Private/Sensitive Content
- Member-only communities
- Personal conversations
- Restricted content
- Premium features
-
High-Value Interactions
- Content creation
- Community moderation
- Direct messaging
- Transaction-based features
-
Compliance Requirements
- Age-restricted content
- Regulated industries
- Terms of service acceptance
- User accountability needs
Security Considerations
Production Security
Production Security
- Prevents unauthorized visitor creation
- Enables server verification of device identity
- Supports automatic token renewal
- Maintains audit trail of visitor sessions
Device Fingerprinting Privacy
Device Fingerprinting Privacy
- Device IDs are anonymized
- No personal information collected
- Automatic cleanup of inactive visitors
- Compliant with GDPR/CCPA requirements
- Disclose visitor tracking in privacy policy
- Provide opt-out mechanisms where required
- Use device IDs only for platform functionality
- Don’t link device IDs to external identifiers
Performance Optimization
Resource Management
Resource Management
-
No Real-Time Connections
- Visitors don’t connect to MQTT
- Reduces concurrent connection load
- Lower bandwidth consumption
- Better scalability for public access
-
No Push Notifications
- Prevents notification system overhead
- Reduces APNs/FCM API calls
- Avoids costs from anonymous audience
- Focuses notifications on engaged users
-
Optimized Query Performance
- Visitors excluded from user searches
- Cleaner user discovery results
- Faster query execution
- Better database performance
Conversion Optimization
Conversion Optimization
Troubleshooting
Visitor login fails with permission error
Visitor login fails with permission error
- Verify visitor mode is enabled - Contact [email protected] if visitor mode has not been enabled for your network
- Check API key has visitor access permissions
- Ensure you’re using correct region endpoint
- For secure mode, verify visitor secure mode is enabled for your network
- For secure mode, verify auth signature is correctly generated
- Check auth signature hasn’t expired
Device ID not persisting across sessions
Device ID not persisting across sessions
- Ensure device storage permissions are granted
- Check that SDK has access to persistent storage
- Verify cache/storage is not being cleared on app restart
- For web: check localStorage is enabled and accessible
- For mobile: verify keychain/SharedPreferences access
Visitor actions not blocked properly
Visitor actions not blocked properly
- Verify user type detection:
client.getCurrentUserType() - Check UIKit version supports visitor mode restrictions
- Ensure server-side permissions are properly configured
- Update to latest SDK version with visitor mode support
- Verify custom behavior overrides aren’t bypassing restrictions
Auth signature verification fails
Auth signature verification fails
- Verify HMAC-SHA256 algorithm is used correctly
- Check message format:
deviceId=${deviceId}&authSignatureExpiresAt=${authSignatureExpiresAt} - Ensure application secret matches your backend configuration
- Verify timestamp format is ISO 8601
- Check signature is hex-encoded, not base64
- Ensure no extra whitespace in signature or timestamp
UIKit pages not hiding for visitors
UIKit pages not hiding for visitors
- Verify UIKit version supports visitor mode UI adaptations
- Check user type is correctly detected in UIKit
- Ensure config.json is properly loaded
- For clips feed: verify
can_view_tabconfiguration - Clear app cache and restart
- Check for custom navigation overrides